This is a note to let you know that I've just added the patch titled bcache: check return value from btree_node_alloc_replacement() to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: bcache-check-return-value-from-btree_node_alloc_replacement.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 777967e7e9f6f5f3e153abffb562bffaf4430d26 Mon Sep 17 00:00:00 2001 From: Coly Li <colyli@xxxxxxx> Date: Mon, 20 Nov 2023 13:24:55 +0800 Subject: bcache: check return value from btree_node_alloc_replacement() From: Coly Li <colyli@xxxxxxx> commit 777967e7e9f6f5f3e153abffb562bffaf4430d26 upstream. In btree_gc_rewrite_node(), pointer 'n' is not checked after it returns from btree_gc_rewrite_node(). There is potential possibility that 'n' is a non NULL ERR_PTR(), referencing such error code is not permitted in following code. Therefore a return value checking is necessary after 'n' is back from btree_node_alloc_replacement(). Signed-off-by: Coly Li <colyli@xxxxxxx> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20231120052503.6122-3-colyli@xxxxxxx Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/md/bcache/btree.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1543,6 +1543,8 @@ static int btree_gc_rewrite_node(struct return 0; n = btree_node_alloc_replacement(replace, NULL); + if (IS_ERR(n)) + return 0; /* recheck reserve after allocating replacement node */ if (btree_check_reserve(b, NULL)) { Patches currently in stable-queue which might be from colyli@xxxxxxx are queue-4.19/bcache-check-return-value-from-btree_node_alloc_replacement.patch queue-4.19/bcache-prevent-potential-division-by-zero-error.patch queue-4.19/bcache-replace-a-mistaken-is_err-by-is_err_or_null-in-btree_gc_coalesce.patch